[XPERIA X10 Android Development] Blagus:
Well, it's not so easy, unfortunately... because in S1Boot, although we have both Red and Brown certificates, there's flag (or flags) preventing it from accepting brown-signed file. That means that we still have to find a security hole in it so we can flash brown files.

I don't remember who was that exactly, however I remember that there was some misunderstanding. I hope it can be fixed and that I can give a little bit of contribution - at least through my valuable source. :)

I don't know about name of this loader on other S1 phones, however S1 loader(s) was/were always simple, and that makes it hard to crack.

Yes, totally normal S1 phone.

Actually, S1 have just few simple loaders which more or less works like this:

load data
check signature
if signature is ok, boot phone
else don't boot

while A1 and A2 phones have bunch of loaders: production loader, pre-boot loader and more which I can't think of at the moment, and in that net of loaders, which makes it complex, it's easy to find a hole, sooner or later, while in S1, single loader's simplicity makes our job harder. That's also reason why S1 phones could never be unlocked without EMMA dongle.

(This is also information from him.)

And yes, .sin file is simply .img which holds additional Red - retail signature (in case of public official updates) on top, after which follows the standard, 1:1 image for flash chip.

So, I think we have to focus on finding a hole in EROM/S1Boot which will allow us to change that flag that's preventing it from accepting brown file.

Once the hole is found and S1Boot accepts the brown image, we would have to do following - either flash brown, original SE loader.sin which will accept any further brown images - that would be the easiest way, because then we would just have to find brown RSA key and sign img-s with that key, and phone would accept it.

Another way would be to make patched S1Boot that could be customized to do whatever we want... would be harder but it can be patched to ignore signature so we could flash unsigned files.

Only thing that must remain is signature in it, because it's checked by ROM at the very beginning of boot - and if it fails there, it could be hard to restore it.

And, I forgot to say, that Retail/Protoype state is written in OTP which can't be modified (only if you change OTP chip but then you need special tools to program it). But Retail/Prototype state won't stop us from modifying S1Boot.

One more thing: difference between prototype and retail is exactly in these flags - and IMO that's actually the reason why prototype phone wouldn't serve us a big purpose - we could flash brown .sin-s to it, so it could be a test phone before releasing it to public... but what about retail phones? That's why retail phone is actually needed because only retail phone has the security which we must break...

Could you answer me then, now when I've explained it, are S1Boot that I'm talking about, and "bootloader" that you guys are talking about, actually the same thing?

We could talk via PM or messenger - if you have Sonork it would be great because I'm logged in Sonork always while I'm connected to Internet, it's simple and preserves conversation history for a long time. ;)